Cloudflare extends WAF protection to private origin applications

Cloudflare has introduced Application Services for Private Origins, enabling secure routing of public traffic to private applications without exposing them to the public internet. This development bridges the gap between public and private infrastructures, allowing users to utilize Cloudflare's security features such as WAF, bot management, and caching on private applications.

Through a unified connectivity model, customers can now apply Cloudflare's services directly to private IPs using existing Cloudflare WAN or Mesh connectivity without the need for additional software. The new capability is currently in closed beta for Enterprise customers, with a target for general availability in Q4 2026.